On-board device and non-transitory storage medium

ABSTRACT

An on-board device includes a processor. The processor is configured to operate as an acquisition unit configured to acquire data from a sensor mounted on a vehicle, a human-machine-interface (HMI) unit configured to perform a process for exerting a human-machine-interface (HMI) function, and a data management unit configured to make determination on a category of the data delivered from the acquisition unit and deliver, to the HMI unit, data in a first category that does not contain data that is not desired to be delivered to the HMI unit. The HMI unit is configured to perform the process for exerting the HMI function based on the data delivered from the data management unit.

CROSS-REFERENCE TO RELATED APPLICATION

This application claims priority to Japanese Patent Application No.2020-035123 filed on Mar. 2, 2020, incorporated herein by reference inits entirety.

BACKGROUND 1. Technical Field

The present disclosure relates to an on-board device and anon-transitory storage medium.

2. Description of Related Art

In a technology described in Japanese Unexamined Patent ApplicationPublication No. 2003-106852 (JP 2003-106852 A), when an occupant of avehicle gives an information search request, vehicle data is transmittedto an information center via a data network, and a search instructionvoice uttered by the occupant of the vehicle is transmitted to theinformation center via a voice network. When a search is made at theinformation center based on the vehicle data and the search instructionvoice uttered by the occupant, search result data information isreceived from the information center and displayed for the occupant ofthe vehicle. Further, search result voice information is received fromthe information center and output for the occupant of the vehicle.

SUMMARY

Vehicles include human-machine-interface (HMI) units configured toperform a process for exerting an HMI function. For example, the HMIunit performs a process for causing a display unit to display a carnavigation screen based on global navigation satellite system (GNSS)data. Along with recent advancement of the HMI function, there is aremarkable advancement of the functions of the HMI unit, such as dataexchange with an external server. When data is delivered to the HMI unitwithout exception, security may be impaired depending on the data.

The present disclosure provides an on-board device and a non-transitorystorage medium in which data security can be ensured without changingthe configuration of an HMI unit configured to perform a process forexerting an HMI function.

An on-board device according to a first aspect of the present disclosureincludes: a processor configured to operate as: an acquisition unitconfigured to acquire data from a sensor mounted on a vehicle; ahuman-machine-interface (HMI) unit configured to perform a process forexerting a human-machine-interface (HMI) function; and a data managementunit configured to make determination on a category of the datadelivered from the acquisition unit, and deliver, to the HMI unit, datain a first category that does not contain data that is not desired to bedelivered to the HMI unit, wherein the HMI unit is configured to performthe process for exerting the HMI function based on the data deliveredfrom the data management unit.

A non-transitory storage medium according to a second aspect of thepresent disclosure stores a program that is executable by a processorincluded in an on-board device having an acquisition unit programmed toacquire data from a sensor mounted on a vehicle, and ahuman-machine-interface (HMI) unit programmed to perform a process forexerting a human-machine-interface (HMI) function, the program causingthe processor to perform functions, as a data management unit,comprising: making determination on a category of the data deliveredfrom the acquisition unit; and delivering, to the HMI unit, data in afirst category that does not contain data that is not desired to bedelivered to the HMI unit, wherein the HMI unit is programmed to performthe process for exerting the HMI function based on the data deliveredfrom the data management unit.

The present disclosure has an effect that data security can be ensuredwithout changing the configuration of the HMI unit configured to performthe process for exerting the HMI function.

BRIEF DESCRIPTION OF THE DRAWINGS

Features, advantages, and technical and industrial significance ofexemplary embodiments of the disclosure will be described below withreference to the accompanying drawings, in which like signs denote likeelements, and wherein:

FIG. 1 is a block diagram illustrating the overall configuration of avehicle data processing system;

FIG. 2 is a functional block diagram of an on-board system;

FIG. 3 is a flowchart illustrating an example of a data acquisitionprocess to be executed by a vehicle data management OS; and

FIG. 4 is a flowchart illustrating an example of a data distributionprocess to be executed by the vehicle data management OS.

DETAILED DESCRIPTION OF EMBODIMENTS

An exemplary embodiment of the present disclosure is described below indetail with reference to the drawings. As illustrated in FIG. 1, avehicle data processing system 10 according to the embodiment includesan on-board system 12 and a data center server 54 (hereinafter referredto simply as “server 54”). The on-board system 12 is mounted on avehicle 40 (see FIG. 2). The on-board system 12 and the server 54 arecommunicable with each other via a network 78. The on-board system 12 isan example of an on-board device.

The on-board system 12 includes an electronic control unit (ECU) 14. TheECU 14 includes a central processing unit (CPU) 16, a memory 18 such asa read only memory (ROM) and a random access memory (RAM), and anon-volatile storage unit 20 such as a hard disk drive (HDD) and a solidstate drive (SSD). The CPU 16, the memory 18, and the storage unit 20are communicably connected together via an internal bus 22.

A sensor unit 24, a communication control unit 34, and a display unit 38are connected to the ECU 14. For example, the communication control unit34 controls communication between the on-board system 12 and the server54. The display unit 38 can display arbitrary information.

The sensor unit 24 includes a plurality of types of sensor including aglobal navigation satellite system (GNSS) sensor 26, an acceleratorpedal sensor 28, a brake pedal sensor 30, and a camera 32. The GNSSsensor 26 receives a positional measurement signal from a GNSS satelliteto acquire GNSS positional measurement information. The acceleratorpedal sensor 28 detects an amount of depression of an accelerator pedal.The brake pedal sensor 30 detects an amount of depression of a brakepedal. The camera 32 shoots the surroundings of the vehicle 40. Examplesof other sensors in the sensor unit 24 include a vehicle speed sensorconfigured to detect a speed of the vehicle, an acceleration sensorconfigured to detect an acceleration of the vehicle, and a steeringangle sensor configured to detect a steering angle of the vehicle.Pieces of data obtained by the sensors in the sensor unit 24 arehereinafter referred to collectively as “vehicle data”. The camera 32 isan example of an image shooting unit.

The storage unit 20 of the ECU 14 stores an IVI virtual environmentproviding program 42, an on-board OS program 44, a general-purpose OSprogram 46, a vehicle data management OS program 48, and a vehicle datadatabase (DB) 50 configured to store vehicle data.

The ECU 14 functions as an IVI virtual environment layer 70 illustratedin FIG. 2 such that the IVI virtual environment providing program 42 isread from the storage unit 20, loaded on the memory 18, and executed bythe CPU 16. The IVI virtual environment layer 70 is a virtual layer thatvirtualizes OSes on IVI. The IVI virtual environment layer 70 enables aplurality of OSes to operate in an IVI virtual environment, and supportsdata exchange between the OSes.

The ECU 14 functions as an on-board OS 72 illustrated in FIG. 2 suchthat the on-board OS program 44 is read from the storage unit 20, loadedon the memory 18, and executed by the CPU 16. The on-board OS 72operates in the IVI virtual environment to acquire vehicle data from thesensor unit 24 and transmit the vehicle data to a vehicle datamanagement OS 76 described later. The on-board OS 72 is an example of anacquisition unit, and is an example of a first OS.

The ECU 14 functions as a general-purpose OS 74 illustrated in FIG. 2such that the general-purpose OS program 46 is read from the storageunit 20, loaded on the memory 18, and executed by the CPU 16. Thegeneral-purpose OS 74 operates in the IVI virtual environment to performa process for implementing an HMI function. The general-purpose OS 74communicates with the server 54 to acquire service data, and provides apredetermined service for a user through an HMI or the like. Thegeneral-purpose OS 74 may communicate with an external server differentfrom the server 54. Examples of the predetermined service include aservice for causing the display unit 38 to display a car navigationscreen. The general-purpose OS 74 requests and acquires necessaryvehicle data from the vehicle data management OS 76 described later. Thegeneral-purpose OS 74 is an example of an HMI unit, and is an example ofa second OS.

The ECU 14 functions as the vehicle data management OS 76 illustrated inFIG. 2 such that the vehicle data management OS program 48 is read fromthe storage unit 20, loaded on the memory 18, and executed by the CPU16, thereby performing a data acquisition process and a datadistribution process described later. The vehicle data management OSprogram 48 is an example of a program according to the presentdisclosure.

The vehicle data management OS 76 operates in the IVI virtualenvironment to perform a process for managing vehicle data. That is, thevehicle data management OS 76 makes determination on a category of datareceived from the on-board OS 72, compresses vehicle data in a secondcategory to be transferred to the server 54, and transfers thecompressed vehicle data to the server 54. The vehicle data management OS76 stores, in the vehicle data DB 50, vehicle data in a category to beaccumulated in the vehicle. The vehicle data management OS 76distributes vehicle data to the on-board OS 72 and the general-purposeOS 74. Regarding the distribution of vehicle data to the general-purposeOS 74, the vehicle data management OS 76 determines whether the vehicledata is vehicle data in a first category that can be distributed to thegeneral-purpose OS 74 in view of security, and avoids distributing thevehicle data when the vehicle data is vehicle data that cannot bedistributed (vehicle data in a category other than the first category).The vehicle data management OS 76 is an example of a data managementunit, and is an example of a third OS.

The server 54 includes a CPU 56, a memory 58, a non-volatile storageunit 60, and a communication control unit 62 configured to controlcommunication between, for example, the server 54 and the on-boardsystem 12. The CPU 56, the memory 58, the storage unit 60, and thecommunication control unit 62 are communicably connected together via aninternal bus 64. The storage unit 60 stores an analysis/serviceproviding program 66. The server 54 executes the analysis/serviceproviding program 66 to receive vehicle data transferred from thevehicle data management OS 76, perform processes of, for example,analyzing big data and using the big data for services, and distributeservice data toward the general-purpose OS 74. The processes ofanalyzing big data, using the big data for services, and the like arealso simply referred as “service” hereinafter.

Next, the data acquisition process is described as an action of theembodiment with reference to FIG. 3. The data acquisition process isexecuted by the vehicle data management OS 76 in response to acquisitionof vehicle data from the sensor unit 24 by the on-board OS 72.

In Step 100, the vehicle data management OS 76 receives, from theon-board OS 72, the vehicle data acquired by the on-board OS 72 from thesensor unit 24. In Step 102, the vehicle data management OS 76determines whether the vehicle data received from the on-board OS 72 isdata to be transmitted to the server 54 by determining whether thevehicle data received from the on-board OS 72 is vehicle data in thesecond category. The vehicle data in the second category is vehicle datathat can be used for the processes in the server 54 for analyzing thedata and using the data for services. Examples of the vehicle data inthe second category include image data obtained by shooting thesurroundings of the vehicle 40 by the camera 32.

When the result of the determination in Step 102 is positive, thevehicle data management OS 76 proceeds to Step 104. In Step 104, thevehicle data management OS 76 compresses the vehicle data received fromthe on-board OS 72 (in this case, the vehicle data in the secondcategory), and transmits the compressed vehicle data to the server 54.The vehicle data transmitted to the server 54 in Step 104 is used forthe processes in the server 54 for analyzing big data and using the bigdata for services. When the result of the determination in Step 102 isnegative, the vehicle data management OS 76 skips Step 104 and proceedsto Step 106.

In Step 106, the vehicle data management OS 76 determines whether thevehicle data received from the on-board OS 72 is vehicle data to beaccumulated in the vehicle 40. The data to be accumulated in the vehicle40 includes vehicle data in the first category that can be distributedto the general-purpose OS 74, and other vehicle data to be distributedto the on-board OS 72.

When the result of the determination in Step 106 is positive, thevehicle data management OS 76 proceeds to Step 108. In Step 108, thevehicle data management OS 76 stores, in the vehicle data DB 50, thevehicle data received from the on-board OS 72, and terminates the dataacquisition process. When the result of the determination in Step 106 isnegative, the vehicle data management OS 76 skips Step 108 andterminates the data acquisition process.

Next, the data distribution process is described with reference to FIG.4. The data distribution process is executed by the vehicle datamanagement OS 76 in response to a request for vehicle data from theon-board OS 72 or the general-purpose OS 74.

In Step 120, the vehicle data management OS 76 determines whether theon-board OS 72 requests the vehicle data. When the on-board OS 72requests the vehicle data, a positive result is obtained through thedetermination in Step 120, and the vehicle data management OS 76proceeds to Step 124. When the general-purpose OS 74 requests thevehicle data, a negative result is obtained through the determination inStep 120, and the vehicle data management OS 76 proceeds to Step 122.

In Step 122, the vehicle data management OS 76 determines whether thevehicle data requested by the general-purpose OS 74 is vehicle data inthe first category that can be distributed to the general-purpose OS 74.For example, the vehicle data in the first category does not containprivacy information. Specifically, the vehicle data in the firstcategory is GNSS positional measurement information acquired by the GNSSsensor 26. When the vehicle data requested by the general-purpose OS 74is the vehicle data in the first category, a positive result is obtainedthrough the determination in Step 122, and the vehicle data managementOS 76 proceeds to Step 124.

In Step 124, the vehicle data management OS 76 reads, from the vehicledata DB 50, the vehicle data requested by the on-board OS 72 or thegeneral-purpose OS 74. In Step 126, the vehicle data management OS 76distributes the vehicle data read in Step 124 to the OS that has giventhe request (on-board OS 72 or general-purpose OS 74), and terminatesthe data distribution process.

When the vehicle data requested by the general-purpose OS 74 is not thevehicle data in the first category, a negative result is obtainedthrough the determination in Step 122. The vehicle data management OS 76skips Steps 124 and 126 and terminates the data distribution process. Inthis case, vehicle data in a category other than the first category,such as image data containing privacy information and obtained byshooting the surroundings of the vehicle 40 by the camera 32, isprevented from being delivered to the general-purpose OS 74.

As described above, the on-board system 12 according to this embodimentincludes the on-board OS 72 configured to acquire vehicle data from thesensor unit 24, the general-purpose OS 74 configured to perform theprocess for exerting the HMI function based on delivered vehicle data,and the vehicle data management OS 76 configured to make determinationon a category of vehicle data delivered from the on-board OS 72 anddeliver data in the first category to the general-purpose OS 74. Thus,the security of vehicle data in a category other than the first categorycan be ensured without changing the configuration of the general-purposeOS 74.

In this embodiment, the vehicle data management OS 76 transmits data inthe second category to the server 54, stores, in the vehicle data DB 50,data containing the data in the first category, and delivers, to thegeneral-purpose OS 74, the data in the first category out of the datastored in the vehicle data DB 50. Thus, the data can selectively betransmitted to the server 54 as well, and the data in the first categorycan be delivered to the general-purpose OS 74 at a timing appropriate tothe general-purpose OS 74 (for example, a timing when thegeneral-purpose OS 74 requests the data).

In this embodiment, the vehicle data management OS 76 compresses thedata in the second category, and transmits the compressed data in thesecond category to the server 54. Thus, it is possible to reduce theamount of the data in the second category to be transmitted to theserver 54, thereby reducing a traffic from the on-board system 12 to theserver 54.

In this embodiment, the on-board OS 72, the general-purpose OS 74, andthe vehicle data management OS 76 operate in the IVI virtualenvironment. Thus, costs can be reduced as compared to a case where theon-board OS 72, the general-purpose OS 74, and the vehicle datamanagement OS 76 operate in environments prepared separately.

In this embodiment, the vehicle data management OS 76 avoids deliveringdata containing privacy information to the general-purpose OS 74. Thus,it is possible to ensure the security of the data containing privacyinformation.

In this embodiment, the vehicle data management OS 76 avoids delivering,to the general-purpose OS 74, image data obtained by shooting thesurroundings of the vehicle by the camera 32. Thus, the security of theimage data can be ensured.

The above description is directed to the mode in which the on-board OS72, the general-purpose OS 74, and the vehicle data management OS 76operate in the IVI virtual environment layer 70. The operationenvironment of each OS is not limited to the IVI virtual environment.

The above description is directed to the mode in which the vehicle datamanagement OS 76 (third OS) functions as the data management unit. Inplace of the OS, an application may function as the data managementunit.

The above description is directed to the mode in which the vehicle datamanagement OS program 48 that is an example of the program according tothe present disclosure is prestored (preinstalled) in the storage unit20. The program according to the present disclosure may be provided bybeing recorded in a non-transitory recording medium such as an HDD, anSSD, or a digital versatile disc (DVD).

An on-board device according to a first aspect of the present disclosureincludes: a processor configured to operate as: an acquisition unitconfigured to acquire data from a sensor mounted on a vehicle; ahuman-machine-interface (HMI) unit configured to perform a process forexerting a human-machine-interface (HMI) function; and a data managementunit configured to make determination on a category of the datadelivered from the acquisition unit, and deliver, to the HMI unit, datain a first category that does not contain data that is not desired to bedelivered to the HMI unit, wherein the HMI unit is configured to performthe process for exerting the HMI function based on the data deliveredfrom the data management unit.

The aspect described above provides the data management unit configuredto make determination on the category of the data delivered from theacquisition unit and deliver the data in the first category to the HMIunit. Therefore, a category of data that is not desired to be deliveredto the HMI unit is excluded from the first category. Thus, the deliveryof this data to the HMI unit can be suppressed. With the aspectdescribed above, data security can be ensured without changing theconfiguration of the HMI unit configured to perform the process forexerting the HMI function.

In the aspect described above, the data management unit may beconfigured to transmit, to a server, data in a second category that isusable for a service, store, in a storage unit, data containing the datain the first category, and deliver, to the HMI unit, the data in thefirst category out of the data stored in the storage unit.

With the configuration described above, the data can selectively betransmitted to the server as well, and the data in the first categorycan be delivered to the HMI unit at a timing appropriate to the HMI unit(for example, a timing when the HMI unit requests the data).

In the aspect described above, the data management unit may beconfigured to compress the data in the second category and transmit thedata in the second category which is compressed to the server.

With the configuration described above, it is possible to reduce theamount of the data in the second category to be transmitted to theserver, thereby reducing a traffic from the on-board device to theserver.

In the aspect described above, the acquisition unit may be implementedby a first operating system (OS) configured to operate in an in-vehicleinfotainment (IVI) virtual environment, the HMI unit may be implementedby a second OS configured to operate in the IVI virtual environment, andthe data management unit may be implemented by a third OS configured tooperate in the IVI virtual environment.

According to the configuration described above, the acquisition unit,the HMI unit, and the data management unit operate in the IVI virtualenvironment. Thus, costs can be reduced as compared to a case where theacquisition unit, the HMI unit, and the data management unit operate inenvironments prepared separately.

In the aspect described above, the data management unit may beconfigured not to deliver, to the HMI unit, data containing privacyinformation as data in a category different from the first category. Thedata management unit may be forbidden to deliver, to the HMI unit, datacontaining privacy information as data in a category different from thefirst category.

With the configuration described above, the security of the datacontaining privacy information can be ensured by avoiding delivering thedata containing privacy information to the HMI unit.

In the aspect described above, the data management unit may beconfigured not to deliver, to the HMI unit, image data obtained byshooting surroundings of the vehicle by an image shooting unit as datain a category different from the first category. The data managementunit may be forbidden to deliver, to the HMI unit, image data obtainedby shooting surroundings of the vehicle by an image shooting unit asdata in a category different from the first category.

It is not desirable to deliver, to the HMI unit, the image data obtainedby shooting the surroundings of the vehicle because the image datacontains privacy information. With the configuration described above,the security of the image data can be ensured by avoiding delivering theimage data to the HMI unit.

In the aspect described above, the HMI unit may be configured to outputinformation based on the data delivered from the data management unit.

A non-transitory storage medium according to a second aspect of thepresent disclosure stores a program that is executable by a processorincluded in an on-board device having an acquisition unit programmed toacquire data from a sensor mounted on a vehicle, and ahuman-machine-interface (HMI) unit programmed to perform a process forexerting a human-machine-interface (HMI) function, the program causingthe processor to perform functions, as a data management unit,comprising: making determination on a category of the data deliveredfrom the acquisition unit; and delivering, to the HMI unit, data in afirst category that does not contain data that is not desired to bedelivered to the HMI unit, wherein the HMI unit is programmed to performthe process for exerting the HMI function based on the data deliveredfrom the data management unit.

According to the aspect described above, similarly to the first aspect,data security can be ensured without changing the configuration of theHMI unit configured to perform the process for exerting the HMIfunction.

What is claimed is:
 1. An on-board device comprising a processorconfigured to operate as: an acquisition unit configured to acquire datafrom a sensor mounted on a vehicle; a human-machine-interface (HMI) unitconfigured to perform a process for exerting a HMI function; and a datamanagement unit configured to: make a determination on a category of theacquired data delivered from the acquisition unit as at least one of afirst category, a second category, and a third category, the firstcategory being different than the second category, the second categorycontaining privacy information that is not to be delivered to the HMIunit, and the third category being usable for a service; store, in astorage unit, data containing first data in the first category; deliver,out of the data stored in the storage unit to the HMI unit, the firstdata in the first category that does not contain other data that is notdesired to be delivered to the HMI unit; block delivery, to the HMIunit, of second data in the second category; and transmit, to a server,third data in the third category that is usable for the service, whereinthe HMI unit is further configured to perform the process for exertingthe HMI function based on the first data delivered from the datamanagement unit, wherein the data management unit is further configuredto compress the third data in the third category and transmit the thirddata in the third category which is compressed to the server, whereinthe acquisition unit is implemented by a first operating system (OS)configured to operate in an in-vehicle infotainment (IVI) virtualenvironment, wherein the HMI unit is implemented by a second OSconfigured to operate in the IVI virtual environment, and wherein thedata management unit is implemented by a third OS configured to operatein the IVI virtual environment.
 2. The on-board device according toclaim 1, wherein the data management unit is configured not to deliver,to the HMI unit, image data obtained by shooting surroundings of thevehicle by an image shooting unit as data in the second category.
 3. Theon-board device according to claim 1, wherein the data management unitis forbidden to deliver, to the HMI unit, data containing the privacyinformation as the data in the second category.
 4. The on-board deviceaccording to claim 1, wherein the data management unit is forbidden todeliver, to the HMI unit, image data obtained by shooting surroundingsof the vehicle by an image shooting unit as data in the second category.5. The on-board device according to claim 1, wherein the HMI unit isconfigured to output information based on the first data delivered fromthe data management unit.
 6. A non-transitory storage medium storing aprogram that is executable by a processor included in an on-board devicehaving an acquisition unit programmed to acquire data from a sensormounted on a vehicle, and a human-machine-interface (HMI) unitprogrammed to perform a process for exerting a HMI function, the programcausing the processor to perform functions, as a data management unit,comprising: making a determination on a category of the acquired datadelivered from the acquisition unit as at least one of a first category,a second category, and a third category, the first category beingdifferent than the second category, the second category containingprivacy information that is not to be delivered to the HMI unit, and thethird category being usable for a service; storing, in a storage unit,data containing first data in the first category; delivering, out of thedata stored in the storage unit to the HMI unit, the first data in thefirst category that does not contain other data that is not desired tobe delivered to the HMI unit; blocking delivery, to the HMI unit, ofsecond data in the second category; and transmitting, to a server, thirddata in the third category that is usable for the service, wherein theHMI unit is further programmed to perform the process for exerting theHMI function based on the first data delivered from the data managementunit, wherein the data management unit is further configured to compressthe third data in the third category and transmit the third data in thethird category which is compressed to the server, wherein theacquisition unit is implemented by a first operating system (OS)configured to operate in an in-vehicle infotainment (IVI) virtualenvironment, wherein the HMI unit is implemented by a second OSconfigured to operate in the IVI virtual environment, and wherein thedata management unit is implemented by a third OS configured to operatein the IVI virtual environment.
 7. An on-board device comprising aprocessor configured to operate as: an acquisition unit configured toacquire data from a sensor mounted on a vehicle, and implemented by afirst operating system (OS) configured to operate in an in-vehicleinfotainment (IVI) virtual environment; a human-machine-interface (HMI)unit configured to perform a process for exerting a HMI function, andimplemented by a second OS configured to operate in the IVI virtualenvironment; and a data management unit configured to: make adetermination on a category of the acquired data delivered from theacquisition unit as at least one of a first category, a second category,and a third category, the first category being different than the secondcategory, the second category containing privacy information that is notto be delivered to the HMI unit, and the third category being usable fora service; deliver, to the HMI unit, first data in the first categorythat does not contain other data that is not desired to be delivered tothe HMI unit; block delivery, to the HMI unit, of second data in thesecond category; and compress third data in the third category andtransmit the third data in the third category which is compressed to aserver, wherein the data management unit is implemented by a third OSconfigured to operate in the IVI virtual environment, and wherein theHMI unit is further configured to perform the process for exerting theHMI function based on the first data delivered from the data managementunit.
 8. A non-transitory storage medium storing a program that isexecutable by a processor included in an on-board device having anacquisition unit programmed to acquire data from a sensor mounted on avehicle, and a human-machine-interface (HMI) unit programmed to performa process for exerting a HMI function, the program causing the processorto perform functions, as a data management unit, comprising: making adetermination on a category of the acquired data delivered from theacquisition unit as at least one of a first category, a second category,and a third category, the first category being different than the secondcategory, the second category containing privacy information that is notto be delivered to the HMI unit, and the third category being usable fora service; delivering, to the HMI unit, first data in the first categorythat does not contain other data that is not desired to be delivered tothe HMI unit; blocking delivery, to the HMI unit, of second data in thesecond category; and compressing third data in the third category andtransmitting the third data in the third category which is compressed toa server, wherein the HMI unit is further programmed to perform theprocess for exerting the HMI function based on the first data deliveredfrom the data management unit, wherein the acquisition unit isimplemented by a first operating system (OS) configured to operate in anin-vehicle infotainment (IVI) virtual environment, wherein the HMI unitis implemented by a second OS configured to operate in the IVI virtualenvironment, and wherein the data management unit is implemented by athird OS configured to operate in the IVI virtual environment.